/**
 * Owner pubkey allowlist for Tier 3 sentient operations.
 *
 * Reads `.cleo/config.json.ownerPubkeys` (array of base64-encoded Ed25519
 * public keys). Used by {@link verifyEventChain} and the revert-executor to
 * reject operations signed by non-owner keys.
 *
 * ## Cache
 *
 * Results are cached for {@link CACHE_TTL_MS} milliseconds (60 s by default).
 * Pass `{ noCache: true }` to force a reload from disk.
 *
 * ## Strict mode
 *
 * Set the environment variable `CLEO_STRICT_ALLOWLIST=1` to make
 * {@link isOwnerSigner} throw an error rather than log a warning when the
 * signer is not in the allowlist.
 *
 * @task T1027
 * @see packages/core/src/sentient/chain-walker.ts
 * @see packages/core/src/sentient/revert-executor.ts
 */
/** Cache lifetime in milliseconds (60 seconds). */
export declare const CACHE_TTL_MS = 60000;
/**
 * Shape of the relevant fields in `.cleo/config.json` for the allowlist.
 */
export interface OwnerAllowlistConfig {
    /** Array of base64-encoded Ed25519 public keys (32 bytes each). */
    ownerPubkeys?: string[];
}
/**
 * Return the current owner pubkey allowlist as raw `Uint8Array` values.
 *
 * Reads `.cleo/config.json` and base64-decodes each entry in
 * `ownerPubkeys`. Results are cached for {@link CACHE_TTL_MS} ms.
 *
 * @param projectRoot - Absolute path to the CLEO project root.
 * @param opts - Optional flags.
 * @param opts.noCache - When `true`, bypass the in-process cache and read from
 *   disk unconditionally.
 * @returns Array of Ed25519 public keys (Uint8Array, 32 bytes each). Empty
 *   array when the config file is absent or `ownerPubkeys` is not set.
 *
 * @example
 * ```ts
 * import { getOwnerPubkeys } from '@cleocode/core/sentient/allowlist.js';
 *
 * const keys = await getOwnerPubkeys('/home/user/project');
 * console.log(`${keys.length} owner keys configured`);
 * ```
 */
export declare function getOwnerPubkeys(projectRoot: string, opts?: {
    noCache?: boolean;
}): Promise<Uint8Array[]>;
/**
 * Check whether a given public key is in the owner allowlist.
 *
 * Comparison uses `crypto.timingSafeEqual` to prevent timing-oracle attacks.
 * Keys of different lengths are automatically rejected without leaking
 * comparison information.
 *
 * When the allowlist is empty **and** `CLEO_STRICT_ALLOWLIST=1` is not set,
 * this function returns `true` (permissive / bootstrapping mode) and writes
 * a warning to stderr so the owner knows they should populate the allowlist.
 *
 * When `CLEO_STRICT_ALLOWLIST=1` is set:
 * - An empty allowlist causes the function to return `false` immediately.
 * - A non-matching key causes the function to return `false`.
 *
 * @param projectRoot - Absolute path to the CLEO project root.
 * @param pubkey - The raw Ed25519 public key to test (32-byte Uint8Array).
 * @returns `true` if the key is in the allowlist (or allowlist is empty and
 *   strict mode is off).
 *
 * @example
 * ```ts
 * import { isOwnerSigner } from '@cleocode/core/sentient/allowlist.js';
 *
 * const allowed = await isOwnerSigner(projectRoot, Buffer.from(event.pub, 'hex'));
 * if (!allowed) {
 *   process.stderr.write(`Warning: signer not in allowlist\n`);
 * }
 * ```
 */
export declare function isOwnerSigner(projectRoot: string, pubkey: Uint8Array): Promise<boolean>;
/**
 * Add an Ed25519 public key (base64-encoded) to the owner allowlist.
 *
 * Reads `config.json`, appends the key (deduplicating if already present),
 * and writes back atomically via tmp-then-rename. Invalidates the in-process
 * cache.
 *
 * @param projectRoot - Absolute path to the CLEO project root.
 * @param pubkeyBase64 - Base64-encoded Ed25519 public key (32 bytes).
 * @throws `Error` if the base64 string does not decode to exactly 32 bytes.
 *
 * @example
 * ```ts
 * import { addOwnerPubkey } from '@cleocode/core/sentient/allowlist.js';
 *
 * await addOwnerPubkey('/home/user/project', 'AAEC...==');
 * ```
 */
export declare function addOwnerPubkey(projectRoot: string, pubkeyBase64: string): Promise<void>;
/**
 * Remove an Ed25519 public key (base64-encoded) from the owner allowlist.
 *
 * Reads `config.json`, removes the matching entry, and writes back atomically.
 * Invalidates the in-process cache.
 *
 * @param projectRoot - Absolute path to the CLEO project root.
 * @param pubkeyBase64 - Base64-encoded Ed25519 public key to remove.
 * @throws `Error` with code `E_ALLOWLIST_KEY_NOT_FOUND` if the key is not
 *   present in the allowlist.
 *
 * @example
 * ```ts
 * import { removeOwnerPubkey } from '@cleocode/core/sentient/allowlist.js';
 *
 * await removeOwnerPubkey('/home/user/project', 'AAEC...==');
 * ```
 */
export declare function removeOwnerPubkey(projectRoot: string, pubkeyBase64: string): Promise<void>;
//# sourceMappingURL=allowlist.d.ts.map